Using CASB to Mitigate Cloud Data Leakage Risks
Short answer
B Implement a cloud access security broker to enforce policies and monitor activity at the cloud service layer.
Question
Key Takeaways
The main trap is confusing reactive monitoring tools like SIEM with proactive enforcement mechanisms; a CASB actively blocks or controls access, whereas SIEM only alerts.
This question addresses how organizations can mitigate data leakage from unauthorized personal cloud storage. The correct solution is implementing a Cloud Access Security Broker (CASB) to enforce security policies at the cloud level.
Common mistake: Option C (SIEM) is often chosen because it raises alerts for suspicious activity. However, SIEM is passive and cannot prevent the upload itself, making it less effective than a CASB for decreasing risk.
Expert Analysis
The scenario involves employees using unauthorized personal cloud storage, creating a risk of data leakage. The core challenge is controlling and monitoring traffic to and from cloud services within an enterprise environment.
Cloud Access Security Broker (CASB) is the industry-standard solution for this specific problem. A CASB sits between the user and the cloud provider, enforcing security policies such as Data Loss Prevention (DLP), access control, and threat protection. It can block unauthorized SaaS applications or encrypt data before it leaves the corporate network, directly addressing the 'shadow IT' and data exfiltration risks described. As noted in community discussions, a CASB acts as a gatekeeper to enforce enterprise security policies as cloud-based resources are accessed.
In contrast, firewall rules (Option A) are generally insufficient because modern cloud services often use HTTPS on standard ports (443). Blocking by IP address is also ineffective due to the dynamic nature of cloud infrastructure and the sheer volume of potential destinations. While SIEM (Option C) provides visibility into alerts, it is a reactive monitoring tool rather than a proactive enforcement mechanism to decrease risk through policy application. File Integrity Monitoring (Option D) tracks changes to local files but does not prevent data from being uploaded to external online storage accounts.
Exam Strategy
When a question asks about securing access to Software-as-a-Service (SaaS) or preventing data loss to cloud platforms, immediately look for 'Cloud Access Security Broker' or 'CASB'. Distinguish between tools that merely monitor (SIEM) and those that enforce policy at the cloud interface (CASB). For cloud-specific threats, traditional network perimeter controls like firewalls are often secondary to cloud-native governance tools.
Frequently Asked Questions
Why can't firewalls block uploads to personal cloud storage?
What is the primary function of a CASB?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
jamestkd 👍 1 Answered BA Cloud Access Security Broker (CASB) is a security software policy enforcement point placed between cloud service consumers and cloud service providers. It acts as a gatekeeper to combine and enforce enterprise security policies as cloud-based resources are accessed. As organizations shift away from traditional on-premise infrastructure toward Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS), and Infrastructure-as-a-Service (IaaS), visibility and control over corporate data become much harder. A CASB addresses this gap.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CAS-005 Questions
Access 135 questions with complete answers and detailed explanations.
View Full CAS-005 Practice Test →